MATHEMATICS OF COMPUTATION Volume 70, Number 234, Pages 873{891 S 0025-5718(00)01197-2 Article electronically published on March 1, 2000 FROBENIUS PSEUDOPRIMES JON GRANTHAM Abstract. The proliferation of probable prime tests in recent years has pro- duced a plethora of definitions with the word \pseudoprime" in them. Exam- ples include pseudoprimes, Euler pseudoprimes, strong pseudoprimes, Lucas pseudoprimes, strong Lucas pseudoprimes, extra strong Lucas pseudoprimes and Perrin pseudoprimes. Though these tests represent a wealth of ideas, they exist as a hodge-podge of definitions rather than as examples of a more general theory. It is the goal of this paper to present a way of viewing many of these tests as special cases of a general principle, as well as to re-formulate them in the context of finite fields. One aim of the reformulation is to enable the creation of stronger tests; another is to aid in proving results about large classes of pseudoprimes. 1. Introduction Fermat's Little Theorem tells us that ap−1 ≡ 1modp for p an odd prime; thus we have an easy way to prove that many numbers are composite. For example, since 290 ≡ 64 mod 91, we prove that 91 is composite. The technique of repeated squaring can be used to perform the required exponentiation very rapidly. This test is not foolproof. In particular, 2340 ≡ 1 mod 341. Composites which fool the test with a = 2 are called pseudoprimes, and in general, composites n with an−1 ≡ 1modn are pseudoprimes to the base a. The existence of such numbers provides incentive to create other tests which are similarly fast, but which may have fewer, or at least different, \pseudoprimes." Two of these tests are more elaborate versions of the test described above and create the notions of Euler pseudoprime and strong pseudoprime. Most other tests, however, involve recurrence sequences. One reason that pseu- doprimes based on recurrence sequences have attracted interest is that the pseudo- primes for these sequence are often different from ordinary pseudoprimes. In fact, nobody has claimed the $620 offered for a Lucas pseudoprime with parameters (1; −1) (see Section 2 for a definition of this term), congruent to 2 or 3 mod 5, that is also a pseudoprime to the base 2 [22], [14]. Furthermore, some tests based on higher order recurrence sequences seem to have few pseudoprimes. Adams and Shanks [2] introduced such a test based on a third order recurrence sequence known as Perrin's sequence. A problem with tests based on recurrence sequences is that analysis of the tests can be difficult. For example, the concepts of Lucas and Lehmer pseudoprimes have been analyzed separately in the literature. In Section 2, we show that they are equivalent definitions. Received by the editor January 6, 1998 and, in revised form, March 29, 1999. 2000 Mathematics Subject Classification. Primary 11Y11. c 2000 American Mathematical Society 873 License or copyright restrictions may apply to redistribution; see https://www.ams.org/journal-terms-of-use 874 JON GRANTHAM Instead of recurrence sequences, the language used in this paper is that of finite fields. In particular, when n is a prime, f(x) 2 Z[x], and n does not divide disc(f), the residue ring Z[x]=(n; f(x)) is a product of finite fields of characteristic n.When n is composite, this ring is not equal to such a product. For a given composite n,this fact is often easy to discover, thus providing a quick proof of the compositeness of n. Using properties of finite fields, we establish the definition of Frobenius probable prime, which is a generalization, and sometimes a strengthening, of many existing definitions. We introduce the concept of Frobenius pseudoprimes, not to inflict a new and different notion of pseudoprimality on the mathematical world, but to show that many existing pseudoprimality tests can be generalized and described in terms of finite fields. In fact, we show that some specific instances of the Frobenius pseudoprime test are equivalent to other pseudoprimality tests, and stronger than many of them. In [11], we use the structure given by the introduction of finite fields to show that the probability of error in declaring a number \prime" using a certain Frobenius 1 test is less than 7710 . In 1980, Monier [19] and Rabin [23] proved that the Strong 1 Probable Prime Test has probability of error at most 4 . Although the test intro- duced in [11] has asymptotic running time three times that of the Strong Probable 1 Prime Test, the proven bound on the error is much smaller than the 64 achieved through three Strong Probable Prime Tests. Perhaps the primary benefit of this approach is that instead of having to prove ten different theorems about ten different types of pseudoprimes, one can prove one theorem about Frobenius pseudoprimes and apply it to each type of pseudoprime. In [12], the techniques of [3] are used to prove that for any monic, squarefree polynomial, there are infinitely many Frobenius pseudoprimes. In particular, this theorem answers a 1982 conjecture of Adams and Shanks [2] that there are in- finitely many Perrin pseudoprimes. It also proves the infinitude of the types of pseudoprimes defined by Gurak [13] and Szekeres [27]. We should note that the idea of primality testing in finite fields is not entirely new. Lenstra's Galois Theory Test [17] is a method of proving primality using finite fields. In [10], I describe the relation between the two ideas. The combination of finite fields and pseudoprimes also exists implicitly in some other works, such as [27]. The goal here, however, is different. I am trying to provide a clear theoretical framework in which various existing probable prime tests can be generalized and analyzed. 2. A wealth of pseudoprimes For the purposes of this paper, the following test for primality will be considered foolproof. If an integer is denoted by the letter p,thenp is prime. If q is a prime power, we let Fq denote a finite field with q elements. We begin by reviewing many of the existing notions of pseudoprimality. Each of these definitions of \pseudoprime" characterizes composite numbers with a certain property. In each of these cases, it can be proven that all prime numbers (with a finite, known set of exceptions) have this property. This paper does not pretend to be an exhaustive treatment of all notions of pseudoprimality. For example, nothing is said about elliptic pseudoprimes [8]. License or copyright restrictions may apply to redistribution; see https://www.ams.org/journal-terms-of-use FROBENIUS PSEUDOPRIMES 875 Fermat's Little Theorem tells us that if p is prime, then ap−1 ≡ 1modp,ifp - a. The original notion of a pseudoprime (sometimes called a Fermat pseudoprime) involves counterexamples to the converse of this theorem. Definition. A pseudoprime to the base a is a composite number n such an−1 ≡ 1modn. Definition. Anumbern which is a pseudoprime to all bases a with (a; n)=1is a Carmichael number. (p−1)=2 ≡ a a We also know that if p is an odd prime, then a p mod p,where p is the Jacobi symbol. The converse of this theorem leads to the definition of Euler pseudoprime, due to Raphael Robinson [24]. Definition. An Euler pseudoprime to the base a is an odd composite number n (n−1)=2 ≡ a with (a; n) = 1 such that a n mod n. An Euler pseudoprime to the base a is also a pseudoprime to the base a. k If n ≡ 1 mod 4, we can also look at a(n−1)=2 for k>1, and doing so gives us the definition of strong pseudoprime [22], due independently to R. Dubois and John Selfridge. Definition. A strong pseudoprime to the base a is an odd composite n =2rs +1 t with s odd such that either as ≡ 1modn,ora2 s ≡−1 for some integer t,with r>t≥ 0. A strong pseudoprime to the base a is also an Euler pseudoprime to the base a [19], [22]. It is possible to define notions of pseudoprimality based on congruence properties of recurrence sequences. The simplest of these are based on the Lucas sequences Un(P; Q), where P and Q are integers, U0 =0,U1 =1andUn = PUn−1 − QUn−2. (When P =1andQ = −1, this is the Fibonacci sequence.) We recall the fact that we can express Un in terms of roots of the polynomial f(x)=x2 − Px + Q.Ifα and β are roots of f(x) in a commutative ring (with n n identity), with α − β invertible, then Un =(α − β )=(α − β). By induction on n, this equality holds even if there are more than two distinct roots of f(x). 2 Theorem 2.1. Let Un = Un(P; Q) and ∆=P − 4Q.Ifp - 2Q∆,thenU − ∆ ≡ p ( p ) 0modp. - 2 − F¯ Proof. Since p ∆, x Px+ Q has distinct roots, α and β,in p. ∆ F p−1 ≡ If p =1,thenf(x)factorsmodp,andα and β are in p.Thusα p−1 ≡ ≡ − − β 1mod p.SoUp−1 (1 1)=(α β)=0modp. ∆ − F If p = 1, then f(x) does not factor, and the roots of f(x) lie in p2 .The Frobenius automorphism permutes the roots of f(x), so αp ≡ β and βp ≡ α.Thus Up+1 ≡ (αβ − βα)=(α − β)=0modp. 2 Definition. Let Un = Un(P; Q)and∆=P − 4Q.ALucas pseudoprime with parameters (P; Q)isacompositen with (n; 2Q∆) = 1 such that U − ∆ ≡ 0modn. n ( n ) Baillie and Wagstaff [7] gave a version of this test that is analogous to the strong pseudoprime test.